gitpython: GitPython: Information disclosure via environment variable expansion in URL handling

A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. When these URLs are processed during Git operations like fetch or pull, the environment variables are expanded and transmitted...

HAProxy-Keepalived-Sec-HighLoads

HAProxy 和 Keepalived（负载均衡器+集群+安全+高负载）安装与配置 HAProxy 是一款开源软件，为基于 TCP 和 HTTP 的高可用性负载均衡应用提供 代理 服务器服务。 Keepalived 是一款开源软件，能够为两台以上服务器提供 IP 故障转移 能力。Keepalived 内部使用 多播 通信技术。 在我们的架构中，我们将使用 HAProxy 作为负载均衡器，并使用 Keepalived 进行 IP 转移，即将 HAProxy 架构实现为 集群 。 我们的场景中有 3 台服务器。我们将在这些服务器上安装 HAProxy，使其成为负载均衡器。然后安装...

GHSA-JV8V-XQ2H-657V SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath

CVE: This vulnerability corresponds to CVE-2026-72802. Summary POST /api/asset/resolveAssetPath returns the resolved absolute filesystem path of an asset, unmodified. The route is CheckAuth-only, so it is reachable by the publish RoleReader token and by the anonymous account when...

EUVD-2026-57462

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath...

SiYuan: Absolute filesystem path and OS username disclosure via resolveAssetPath

CVE: This vulnerability corresponds to CVE-2026-72802. Summary POST /api/asset/resolveAssetPath returns the resolved absolute filesystem path of an asset, unmodified. The route is CheckAuth-only, so it is reachable by the publish RoleReader token and by the anonymous account when...

log4shell_ioc_ips

j4shelliocips 来自已知 log4j/log4shell 恶意IP地址的大型数据转储，唯一且已排序，仅在发生变化时每小时更新一次！（CVE-2021-44228） 狩猎愉快 免责声明 此脚本解析大量来源，因此此列表可能包含大量误报，请不要在防火墙中屏蔽所有IP！ 待办事项： 添加白名单 正在进行中 改进正则表达式以排除本地IP地址 已解决 添加对域名的支持 来源： https://gist.github.com/gnremy/c546c7911d5f876f263309d7161a7217...

ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution

A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git configuration flags through the src field...

aiohttp: AIOHTTP: Denial of Service via malformed HTTP responses

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability involves an out-of-bounds heap read in the C response parser when processing malformed HTTP responses. An attacker operating a malicious server, or even an accidental malformed response, could exploit th...

jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously...

ansible-core: argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)

A flaw was found in ansible-core. The extractcollectionfromgit function in ansible-core's concreteartifactmanager.py constructs git clone commands without a '--' end-of-options separator before user-supplied URLs when installing collections from git sources. An attacker who provides a crafted...

Important: Red Hat Security Advisory: Satellite 6.17.11 Async Update

A new release is now available for Red Hat Satellite 6.17 for RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the CookieJar.load function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicio...

aiohttp: AIOHTTP: HTTP Request Smuggling via WebSocket Upgrade

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework. This vulnerability allows a remote attacker to perform HTTP request smuggling due to an edge case in the WebSocket upgrade procedure. When a WebSocket upgrade request includes a body, the parser may switch protocols before...

ruby-jwt: ruby-jwt: Authentication bypass due to empty key in HMAC verification

A flaw was found in ruby-jwt, a Ruby implementation of the RFC 7519 OAuth JSON Web Token JWT standard. A remote attacker can exploit this vulnerability by crafting a malicious token that is accepted due to an empty key being used in the HMAC Hash-based Message Authentication Code digest calculati...

jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator PTV when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic typ...

com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser

A flaw was found in jackson-core. A remote attacker can exploit an incomplete fix in the non-blocking JSON parser by streaming specially crafted JSON data in small chunks. This bypasses the intended number length constraint, causing the parser to accumulate excessive memory per connection. This...

perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine.

A flaw was found in Perl. An integer overflow vulnerability in the regular expression engine's superlinear cache calculation can lead to out-of-bounds memory reads and writes. A remote attacker could exploit this by providing a specially crafted, large input string during regular expression...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: perl: perl-5.42.2-525.1.hum1 aarch64, x8664 perl-Attribute-Handlers-1.03-525.1.hum1 noarch perl-AutoLoader-5.74-525.1.hum1 noarch perl-AutoSplit-5.74-525.1.hum1 noarch perl-B-1.89-525.1.hum1...

EUVD-2026-57463

SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes name, alias, memo, custom fields of protected documents...

GHSA-QVQ9-HQ6P-V378 SiYuan: Missing publish-access filter on getBlockAttrs and batchGetBlockAttrs discloses block attributes (name, alias, memo, custom fields) of protected documents

CVE: This vulnerability corresponds to CVE-2026-72803. Summary POST /api/attr/getBlockAttrs and POST /api/attr/batchGetBlockAttrs return a block's full attribute set IAL with no publish-access check. Both are CheckAuth-only, so they are reachable by the publish RoleReader token and by the anonymo...